Technical articles, standards guidance, and community insight on IAM, PAM, and Zero Trust.
Passwords & HashingYour team just failed another phishing simulation. You ve run the awareness training, sent reminder emails, and posted security tips. Yet someone still clicked the link, and now you re explaining to l
Multi-Factor MethodsWhat Changed In March 2026, law enforcement disrupted 330 domains linked to Tycoon 2FA, a major phishing kit in Okta s Identity Threat Protection telemetry. While detections initially dropped, they so
Identity LifecycleThe Challenge In December 2023, Microsoft filed suit against Storm 1152, a Vietnamese cybercrime-as-a-service group responsible for creating and selling 750 million fraudulent Outlook and Hotmail acco
Tokens & SessionsThe Problem: Why This Matters Now On March 24, 2026, threat actors pushed malicious updates to LiteLLM , a gateway tool that lets developers call over 2,000 language models from more than 100 provider
Get weekly security insights and compliance updates delivered to your inbox.
Governance & ComplianceYour organization just deployed a generative AI model, and your compliance team wants to know which NIST SP 800-53 controls apply. Your answer shouldn t be all of them. NIST s approach to AI security
FIDO & PasskeysWhat Happened The authentication model that s protected enterprise systems for two decades has hit a breaking point. Organizations have treated identity verification as a one-time event: check credent
FIDO & PasskeysMicrosoft s decision to make passkeys the default authentication method in Entra ID and Google s integration of FIDO2 security keys for Google Workspace users Windows login marks a pivotal shift in en
Identity LifecycleKantara Initiative has just published the SP 800-63B-4 Service Assessment Criteria, and your inbox is probably already filling with vendor pitches about becoming compliant. Before you schedule another
Passwords & HashingYou ve spent years getting your team to adopt a password manager. Multi-Factor Cryptographic Devices protect privileged accounts. Your security awareness training finally mentions phishing. Now you re
OAuth & OIDCMicrosoft customers are experiencing a 15x increase in device code phishing attacks this year, according to Push Security . These attacks exploit OAuth 2.0 s Device Code Authorization Grant, facilitat
OAuth & OIDCIf you re implementing OpenID for Verifiable Presentations (OpenID4VP) or OpenID for Verifiable Credential Issuance (OpenID4VCI) , you need a clear path from development to public certification. The O
Directory ServicesSecOps teams spend years refining role-based access control (RBAC) to enforce least privilege. Now the same principles are being weaponized against you. Work Panel, a multi-tenant vishing platform use
Directory ServicesYou re ready to deploy passkeys. You ve read the NIST SP 800-63-4 guidance, you understand WebAuthn domain -binding, and your executive sponsor wants phishing-resistant authentication live by Q2. Now
OAuth & OIDCYou re building a digital identity system that needs to work across multiple sectors, integrate with government frameworks, and remain viable as standards evolve. The shift from prescriptive architect
FIDO & PasskeysYou ve read the NCSC announcement. FIDO2 credentials are more secure than traditional multi-factor authentication against common attacks. Your CISO forwarded the paper. Your board is asking questions.
FIDO & PasskeysYou re facing a decision that affects every authentication flow in your organization: how aggressively should you move toward passwordless authentication with passkeys ? The FIDO Alliance reports that
OAuth & OIDCWhat Happened A study by the FIDO Alliance and HID surveyed 500 IT and cybersecurity decision-makers across five countries and sectors. The research highlighted a significant gap: 94% of organizations
Identity LifecycleYou re confident your team can revoke a departing employee s access within 24 hours. Yet, more than one-third of organizations in a FIDO Alliance and HID survey shared that confidence, only to admit t
FIDO & PasskeysThe question isn t whether to adopt passkeys . With 93 percent of organizations on the adoption path and 65 percent reporting high technical familiarity, the technology is well understood. The real qu
Authorization ConceptsThe Challenge The OpenID Foundation s AuthZEN Working Group tackled a key interoperability issue: AuthZEN offers a standardized API for authorization decisions, but each protocol and system uses diffe
